wanar-ai@1.0.7: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

wanar-ai@1.0.7: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/security-scanner.jsView file

5L6: import axios from 'axios'; L7: import fs from 'fs'; ... L11: const __filename = fileURLToPath(import.meta.url); L12: const __dirname = path.dirname(__filename); L13: ... L297: const cleaned = result.content.replace(/```json\s*/g, '').replace(/```\s*/g, '').trim(); L298: const aiResponse = JSON.parse(cleaned); L299: console.log('[AI Analysis] JSON parsed successfully'); ... L1125: try { L1126: await axios.post(target, { L1127: username: username,

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

src/security-scanner.jsView on unpkg · L5

1163patternName = generic_password severity = medium line = 1163 matchedText = { userna...' },

Medium

Secret Pattern

Package contains a possible secret pattern.

src/security-scanner.jsView on unpkg · L1163

4091patternName = generic_password severity = medium line = 4091 matchedText = result.c... });

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4091

4120patternName = generic_password severity = medium line = 4120 matchedText = { cmd: '...) },

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4120

4223patternName = generic_password severity = medium line = 4223 matchedText = if (user...}));

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4223

4265patternName = generic_password severity = medium line = 4265 matchedText = if (user...}));

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4265

4311patternName = generic_password severity = medium line = 4311 matchedText = if (user...}));

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4311

4391patternName = generic_password severity = medium line = 4391 matchedText = if (emai... });

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4391

5368patternName = generic_password severity = medium line = 5368 matchedText = credenti... });

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L5368

client/dist/assets/index-Yf8uu-wW.jsView file

108`+(s.tokens?this.parseInline(s.tokens):s.text);r+=n?this.renderer.paragraph(l):l;continue}default:{const s='Token with "'+i.type+'" type was not found.';if(this.options.silent)retu... L109: Please report this to https://github.com/markedjs/marked.`,e){const a="<p>An error occurred:</p><pre>"+Tt(r.message+"",!0)+"</pre>";return n?Promise.resolve(a):a}if(n)return Promis... L110: https://github.com/highlightjs/highlight.js/issues/2277`),F=D,w=U),P===void 0&&(P=!0);const q={code:w,language:F};se("before:highlight",q);const k=q.result?q.result:_(q.language,q....

High

Child Process

Package source references child process execution.

client/dist/assets/index-Yf8uu-wW.jsView on unpkg · L108

112`},E]}}return _c=a,_c}var pc,HE;function DI(){if(HE)return pc;HE=1;function t(e){const n="[a-zA-Z_][\\w.]*",r="<\\?(lasso(script)?|=)",a="\\]|\\?>",i={$pattern:n+"|&[lg]t;",literal... L113: ]`,h={scope:"string",variants:[_,u,p,f]},S={scope:"number",variants:[{begin:"\\b0[bB][01]+(?:_[01]+)*\\b"},{begin:"\\b0[oO][0-7]+(?:_[0-7]+)*\\b"},{begin:"\\b0[xX][\\da-fA-F]+(?:_[... L114: ]*;`,relevance:0},{begin:"[vp][0-9]+"}]}}return xd=t,xd}var Nd,aS;function VA(){if(aS)return Nd;aS=1;function t(e){const n="[a-z][a-zA-Z0-9_]*",r={className:"string",begin:"\\$.{1}...

High

Shell

Package source references shell execution.

client/dist/assets/index-Yf8uu-wW.jsView on unpkg · L112

src/ai-manager.jsView file

81- JANGAN pernah bilang "saya tidak bisa mengakses" sebelum mencoba L82: - Jobstreet Indonesia: https://www.jobstreet.co.id/jobs L83: - Glints: https://glints.[redacted] ... L321: - **XSS**: Reflected, Stored, DOM-based L322: - **Insecure Deserialization**: eval(), unserialize dari user input L323: - **Using Components with Known Vulnerabilities**: Outdated dependencies dengan CVE ... L387: - ....//....//etc/passwd (bypass filter) L388: - Wrapper exploitation (php://filter, data://) L389: L390: **Command Injection** L391: - ; cat /etc/passwd L392: - | whoami

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/ai-manager.jsView on unpkg · L81

321- **XSS**: Reflected, Stored, DOM-based L322: - **Insecure Deserialization**: eval(), unserialize dari user input L323: - **Using Components with Known Vulnerabilities**: Outdated dependencies dengan CVE

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/ai-manager.jsView on unpkg · L321

src/server.jsView file

1497app.post('/api/job-agent/launch-chrome', asyncHandler(async (req, res) => { L1498: const { execSync, spawn } = await import('child_process'); L1499: ... L1501: try { L1502: const cdpRes = await fetch('http://localhost:9222/json/version', { signal: AbortSignal.timeout(1500) }); L1503: if (cdpRes.ok) { ... L1511: 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe', L1512: `C:\\Users\\${process.env.USERNAME}\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe`, L1513: ];

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/server.jsView on unpkg · L1497

src/tools/job-agent.jsView file

121const origin = new URL(url).origin; L122: const res = await fetch(`${origin}/robots.txt`).catch(() => null); L123: if (!res || !res.ok) return true; L124: const text = await res.text(); L125: if (/disallow.*\/apply|disallow.*\/jobs.*apply/i.test(text)) return false; ... L206: const base64Audio = audioBuffer.toString('base64'); L207: const googleSpeechKey = process.env.GOOGLE_SPEECH_API_KEY; L208: if (!googleSpeechKey) { ... L216: headers: { 'Content-Type': 'audio/x-flac; rate=16000' }, L217: body: audioBuffer, L218: } ... L318: // PENTING: Google Forms memiliki elemen Google Account di header —

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

src/tools/job-agent.jsView on unpkg · L121

121Trigger-reachable credential exfiltration chain: scripts.dev -> src/server.js -> src/tools/job-agent.js L121: const origin = new URL(url).origin; L122: const res = await fetch(`${origin}/robots.txt`).catch(() => null); L123: if (!res || !res.ok) return true; L124: const text = await res.text(); L125: if (/disallow.*\/apply|disallow.*\/jobs.*apply/i.test(text)) return false; ... L206: const base64Audio = audioBuffer.toString('base64'); L207: const googleSpeechKey = process.env.GOOGLE_SPEECH_API_KEY; L208: if (!googleSpeechKey) { ... L216: headers: { 'Content-Type': 'audio/x-flac; rate=16000' }, L217: body: audioBuffer, L218: } ... L318: // PENTING: Google Forms memiliki elemen Google Account di header —

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

src/tools/job-agent.jsView on unpkg · L121

Source & flagged code

18 flagged

package.jsonView file

Lines 7-47json

7 "bin": {

8 "wanar": "bin/wanar.js",

9 "wanarai": "bin/wanarai.js"

10 },

11 "files": [

12 "src/",

13 "bin/",

14 "config/",

15 "scripts/",

16 "client/dist/",

17 ".env.example",

18 "README.md"

19 ],

20 "scripts": {

21 "start": "node src/index.js",

22 "cli": "node src/cli.js",

23 "web": "node src/server.js",

24 "test": "node src/test.js",

25 "dev": "node --watch src/server.js",

26 "analytics": "node src/tools/analytics-cli.js",

27 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 },

29 "keywords": [

30 "ai",

31 "agent",

32 "enterprise",

33 "openagentic",

34 "nvidia",

35 "vector",

36 "multi-provider",

37 "intelligent-routing",

38 "context-management",

39 "semantic-cache",

40 "analytics",

41 "chatbot",

42 "cli",

43 "terminal"

44 ],

45 "author": "Wisnu Alfian Nur Ashar",

46 "license": "MIT",

47 "repository": {

src/security-scanner.jsView file

Lines 1143-1183javascript

1143 }

1144

1145 } catch (error) {

1146 test.result = 'error';

1147 test.details.push(`Test error: ${error.message}`);

1148 }

1149

client/dist/assets/index-Yf8uu-wW.jsView file

108`+(s.tokens?this.parseInline(s.tokens):s.text);r+=n?this.renderer.paragraph(l):l;continue}default:{const s='Token with "'+i.type+'" type was not found.';if(this.options.silent)retu... L109: Please report this to https://github.com/markedjs/marked.`,e){const a="<p>An error occurred:</p><pre>"+Tt(r.message+"",!0)+"</pre>";return n?Promise.resolve(a):a}if(n)return Promis... L110: https://github.com/highlightjs/highlight.js/issues/2277`),F=D,w=U),P===void 0&&(P=!0);const q={code:w,language:F};se("before:highlight",q);const k=q.result?q.result:_(q.language,q....

High

Child Process

Package source references child process execution.

client/dist/assets/index-Yf8uu-wW.jsView on unpkg · L108

112`},E]}}return _c=a,_c}var pc,HE;function DI(){if(HE)return pc;HE=1;function t(e){const n="[a-zA-Z_][\\w.]*",r="<\\?(lasso(script)?|=)",a="\\]|\\?>",i={$pattern:n+"|&[lg]t;",literal... L113: ]`,h={scope:"string",variants:[_,u,p,f]},S={scope:"number",variants:[{begin:"\\b0[bB][01]+(?:_[01]+)*\\b"},{begin:"\\b0[oO][0-7]+(?:_[0-7]+)*\\b"},{begin:"\\b0[xX][\\da-fA-F]+(?:_[... L114: ]*;`,relevance:0},{begin:"[vp][0-9]+"}]}}return xd=t,xd}var Nd,aS;function VA(){if(aS)return Nd;aS=1;function t(e){const n="[a-z][a-zA-Z0-9_]*",r={className:"string",begin:"\\$.{1}...

High

Shell

Package source references shell execution.

client/dist/assets/index-Yf8uu-wW.jsView on unpkg · L112

src/ai-manager.jsView file

Lines 301-341javascript

301 - Closure salah tangkap variabel di loop

302 - Mutasi object/array tidak disengaja

303 - == vs === issues

304 - Memory leak dari event listener tidak di-cleanup

305

3063.

src/server.jsView file

Lines 1477-1517javascript

1477

1478// POST /api/job-agent/sessions/:id/start — mulai crawl & apply

1479app.post('/api/job-agent/sessions/:id/start', asyncHandler(async (req, res) => {

1480 const id = Number

src/tools/job-agent.jsView file

Lines 101-141javascript

101 for (const mapping of FIELD_MAP) {

102 if (mapping.patterns.some(p => p.test(normalized))) {

103 const value